Bug 105606 – Various tests in media/track are intermittently crashing

• Status: RESOLVED
• Resolution: FIXED
• Component: Media

[Ryosuke Niwa]

They all seem to have the same stack trace:

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x0000000103343825 void WebCore::removeAllChildrenInContainer<WebCore::Node, WebCore::ContainerNode>(WebCore::ContainerNode*) + 229 (ContainerNodeAlgorithms.h:104)
1   com.apple.WebCore             	0x000000010342d13b WebCore::Document::removedLastRef() + 539 (OwnPtr.h:72)
2   com.apple.WebCore             	0x0000000103f04423 WebCore::TagNodeList::~TagNodeList() + 291 (Weak.h:143)
3   com.apple.WebCore             	0x0000000103f045e3 WebCore::HTMLTagNodeList::~HTMLTagNodeList() + 67 (RefCounted.h:197)
4   com.apple.WebCore             	0x0000000103991901 WebCore::JSNodeListOwner::finalize(JSC::Handle<JSC::Unknown>, void*) + 65 (JSNodeList.h:58)
5   com.apple.JavaScriptCore      	0x0000000102c97f4c JSC::WeakBlock::sweep() + 108 (WeakImpl.h:84)
6   com.apple.JavaScriptCore      	0x0000000102c982b8 JSC::WeakSet::sweep() + 40 (DoublyLinkedList.h:118)
7   com.apple.JavaScriptCore      	0x0000000102bcf2d8 JSC::MarkedBlock::sweep(JSC::MarkedBlock::SweepMode) + 24 (MarkedBlock.cpp:112)
8   com.apple.JavaScriptCore      	0x0000000102c96fa3 JSC::MarkedAllocator::allocateSlowCase(unsigned long) + 99 (MarkedAllocator.cpp:34)
9   com.apple.JavaScriptCore      	0x0000000102b8c52d JSC::FunctionPrototype::create(JSC::ExecState*, JSC::JSGlobalObject*, JSC::Structure*) + 77 (MarkedAllocator.h:78)
10  com.apple.JavaScriptCore      	0x0000000102b87c21 JSC::JSGlobalObject::reset(JSC::JSValue) + 209 (JSGlobalObject.cpp:202)
11  com.apple.WebCore             	0x000000010389a523 WebCore::JSDOMWindowBase::finishCreation(JSC::JSGlobalData&, WebCore::JSDOMWindowShell*) + 35 (JSDOMWindowBase.cpp:69)
12  com.apple.WebCore             	0x000000010389ef7f WebCore::JSDOMWindow::create(JSC::JSGlobalData&, JSC::Structure*, WTF::PassRefPtr<WebCore::DOMWindow>, WebCore::JSDOMWindowShell*) + 175 (JSDOMWindow.h:42)
13  com.apple.WebCore             	0x000000010389ec7c WebCore::JSDOMWindowShell::setWindow(WTF::PassRefPtr<WebCore::DOMWindow>) + 380 (JSDOMWindowShell.cpp:75)
14  com.apple.WebCore             	0x0000000103d6d234 WebCore::ScriptController::clearWindowShell(WebCore::DOMWindow*, bool) + 276 (PassRefPtr.h:68)
15  com.apple.WebCore             	0x00000001035d2b9f WebCore::FrameLoader::clear(WebCore::Document*, bool, bool, bool) + 271 (FrameLoader.cpp:568)
16  com.apple.WebCore             	0x0000000103459b61 WebCore::DocumentWriter::begin(WebCore::KURL const&, bool, WebCore::Document*) + 369 (DocumentWriter.cpp:135)
17  com.apple.WebCore             	0x00000001034497db WebCore::DocumentLoader::commitData(char const*, unsigned long) + 91 (RefPtr.h:56)
18  com.apple.WebKit              	0x0000000102fae7b4 -[WebHTMLRepresentation receivedData:withDataSource:] + 100 (WebHTMLRepresentation.mm:186)
19  com.apple.WebKit              	0x0000000102f8149d -[WebDataSource(WebInternal) _receivedData:] + 77 (WebDataSource.mm:216)
20  com.apple.WebKit              	0x0000000102f994f7 WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char const*, int) + 103 (WebFrameLoaderClient.mm:841)
21  com.apple.WebCore             	0x0000000103449a20 WebCore::DocumentLoader::commitLoad(char const*, int) + 144 (RefCounted.h:148)
22  com.apple.WebCore             	0x0000000103b33ec3 WebCore::MainResourceLoader::dataReceived(WebCore::CachedResource*, char const*, int) + 787 (MainResourceLoader.cpp:497)
23  com.apple.WebCore             	0x0000000103300145 WebCore::CachedRawResource::data(WTF::PassRefPtr<WebCore::ResourceBuffer>, bool) + 309 (CachedRawResource.cpp:70)
24  com.apple.WebCore             	0x0000000103e4427a WebCore::SubresourceLoader::sendDataToResource(char const*, int) + 122 (PassRefPtr.h:68)
25  com.apple.WebCore             	0x0000000103e4435c WebCore::SubresourceLoader::didReceiveData(char const*, int, long long, bool) + 76 (ResourceLoader.h:142)
26  com.apple.WebCore             	0x0000000103d4dd48 WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle*, char const*, int, int) + 136 (InspectorInstrumentation.h:260)
27  com.apple.Foundation          	0x00007fff87ee6f58 __65-[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:]_block_invoke_0 + 28
28  com.apple.Foundation          	0x00007fff87ee6e9c -[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:] + 227
29  com.apple.Foundation          	0x00007fff87ee6d98 -[NSURLConnectionInternal _withActiveConnectionAndDelegate:] + 63
30  com.apple.Foundation          	0x00007fff87ee992b _NSURLConnectionDidReceiveData_LengthReceived + 86
31  com.apple.CFNetwork           	0x00007fff8971d7b1 ___delegate_didReceiveDataArray_block_invoke_0 + 132
32  com.apple.CFNetwork           	0x00007fff89710753 ___withDelegateAsync_block_invoke_0 + 90
33  com.apple.CFNetwork           	0x00007fff8979f2ca __block_global_1 + 28
34  com.apple.CoreFoundation      	0x00007fff92f8c724 CFArrayApplyFunction + 68
35  com.apple.CFNetwork           	0x00007fff89701a6c RunloopBlockContext::perform() + 126
36  com.apple.CFNetwork           	0x00007fff8970194b MultiplexerSource::perform() + 221
37  com.apple.CoreFoundation      	0x00007fff92f6e101 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
38  com.apple.CoreFoundation      	0x00007fff92f6da25 __CFRunLoopDoSources0 + 245
39  com.apple.CoreFoundation      	0x00007fff92f90dc5 __CFRunLoopRun + 789
40  com.apple.CoreFoundation      	0x00007fff92f906b2 CFRunLoopRunSpecific + 290
41  com.apple.Foundation          	0x00007fff87f6489e -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 268
42  DumpRenderTree                	0x00000001028b24c9 runTest(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 1624 (DumpRenderTree.mm:1378)
43  DumpRenderTree                	0x00000001028b1c54 dumpRenderTree(int, char const**) + 1855 (DumpRenderTree.mm:842)
44  DumpRenderTree                	0x00000001028b2832 main + 86 (DumpRenderTree.mm:927)
45  libdyld.dylib                 	0x00007fff89a677e1 start + 1

[Ryosuke Niwa]

I’ve seen crashes on:
media/track/tracklist-is-reachable.html
media/track/text-track-cue-is-reachable.html
media/track/text-track-is-reachable.html
media/track/track-webvtt-tc005-header-comment.html
media/track/track-webvtt-tc004-magic-header.html
media/track/track-webvtt-tc016-align-positioning.html

But looking at the commit queue, other tests are also crashing.

[Ilya Tikhonovsky]

Created attachment 180491 [details]
Patch

[Ryosuke Niwa]

Comment on attachment 180491 [details]
Patch

The fix looks reasonable. I'm hoping that either Dean or Eric could review it.

[Eric Seidel (no email)]

Comment on attachment 180491 [details]
Patch

LGTM.

[Ilya Tikhonovsky]

Comment on attachment 180491 [details]
Patch

Clearing flags on attachment: 180491

Committed r138381: <http://trac.webkit.org/changeset/138381>

[Ilya Tikhonovsky]

All reviewed patches have been landed.  Closing bug.

[Eric Carlson]

(In reply to comment #3)
> (From update of attachment 180491 [details])
> The fix looks reasonable. I'm hoping that either Dean or Eric could review it.

It looks correct to me as well, thank you!

[Ilya Tikhonovsky]

*** Bug 105657 has been marked as a duplicate of this bug. ***